Poisonous Mars, or how LuciDoor knocks on the doors of the CIS

• We identified attacks targeting telecommunications companies in Kyrgyzstan and Tajikistan.
• The TTPs and toolset suggest a threat actor similar to the East Asian group UnsolicitedBooker.
• The campaigns used two different backdoors: LuciDoor and MarsSnake.
• The group also used several unique tools that are rarely seen and appear to be of Chinese origin.
• In these attacks, the malware posed as legitimate Microsoft software.

In the fall of 2025, the PT ESC team identified a set of attacks targeting telecommunications companies in Kyrgyzstan. The activity stood out because the attackers used unusual documents that relied on two rare tools of Chinese origin, along with unique software.

During the investigation, we confirmed that the MarsSnake backdoor was used in these attacks. ESET researchers had previously documented this malware and mentioned it in a quarterly report. Our analysis of its functionality also revealed additional attacks targeting CIS countries and Chinese organizations.

In late September, attackers emailed organizations in Kyrgyzstan.

The emails used a simple lure. They asked for information on mobile service tariff plans, and the text stayed the same across messages. The only change was the name of the supposed "client." The senders relied on Microsoft consumer mail services, using Hotmail and Outlook accounts.

In every case we identified, the email included a document attachment. For example: "Тарифные пакеты SIM-карт мобильных телефонов.doc" (SHA-256: e6a28b3833384018bad60043c82bb4cfcce86a3418ece86ea0d71c7aac9ca22b).

Opening the document displayed a decoy image that prompted the recipient to "enable content." The decoy stands out and contains several distinctive elements, which we describe below.

After the victim enabled content, the document displayed a provider tariff plan. However, the email itself referenced a different provider. In the emails we observed, the intended target and the attached phishing document did not match.

The document includes an OLE object named NewMacros. The macro is heavily obfuscated, but the underlying behavior is simple. It reconstructs a payload from many hex-encoded strings, converts the result to bytes, saves it to C:\ProgramData as Perfrom.exe, and then runs it. The executable uses a OneDrive icon.

Perfrom.exe is a loader that we named LuciLoad, based on its link to the next stage, the LuciDoor backdoor. When it runs, LuciLoad performs the following actions:

1. Creates a hidden window titled OneDriveLauncher.

2. Decrypts the configuration using the RC4 algorithm.

Table 1. Configuration structure

3. Extracts an image from its resources and decrypts it with the RC4 algorithm using the key "microsoft".

4. Decompresses the data with the LZNT1 algorithm via RtlDecompressBuffer.

5. Reflectively loads the resulting PE module.

6. Calls the module's exported function and passes the decrypted configuration as an argument.

Like the loader, the next stage, the backdoor, is written in C++. We describe it in detail below.

In late November, attacks in Kyrgyzstan resumed. The attackers again used a document that displayed an image prompting the recipient to enable macros. After macros were enabled, the macro opened a second document.

As in previous cases, the phishing content did not align with the targeted organizations. The text stayed within a telecommunications theme, but it did not match the victim. In the cases we observed, Company A was targeted while the phishing document content was prepared for Company B.

The macro was again heavily obfuscated. It dropped two files into the following directory: C:\Users\admin\AppData\Local\Microsoft\PlayReady\:

• Plasrv.exe (SHA-256: 2d1c235ddc76d427c48c39c22e6dc50 141f09 734 270eaf01 778 713f987e99cc4), a legitimate Microsoft file
• PDH.DLL (SHA-256: 01f28cefdcf3940c19efd7a0446aa0e56c56bc7c955 774c94d6d469fca627a4e), a malicious library used for DLL sideloading

Unlike the earlier attacks, this campaign deployed the MarsSnake backdoor.

In January 2026, the group became active again. As before, the lures were telecommunications-related.

In the 2025 activity, the attackers delivered malicious documents as email attachments. In 2026, they switched to links placed directly in the email body. One example is the following:

mail.ru.cdhgwnjjcw.xyz/downloadFile/54/66f4ef1f67499bfef117afa5380eced1

In 2026, the attackers also changed the image used to prompt recipients to enable the malicious macro.

This activity closely matched the September campaign. The attackers again deployed the LuciDoor backdoor, loaded by the LuciLoad loader. We observed two changes. LuciLoad was saved under a different name, explorer.exe, and its configuration was modified. The final payload was the same as in September.

As noted earlier, the decrypted LuciLoad configuration includes a campaign timestamp in addition to the C2 server and port.

In this campaign, LuciDoor used 93.157.106.75 as its C2 server. MarsSnake also used this IP address in the November attack.

In the first attack, the attackers deployed the LuciDoor backdoor. The name comes from its console font setting, Lucida Console 11×18, which supports readable terminal output.

LuciDoor stands out for how persistently it tries to establish C2 connectivity. It starts with a direct connection. If that fails, it attempts to connect through the system proxy and cycles through several proxy mechanisms. If those attempts fail as well, it falls back to the user's active proxy nodes.

LuciDoor is reflectively loaded by LuciLoad. Its execution flow includes the following steps:

1. If the configuration sets the persistence flag, LuciDoor does the following:

• Checks whether the current process is running from an allowed file system location.
• Determines the integrity level of the current process.
• Builds a destination path based on the current user's privileges:
  • For a standard user, it uses %AppData%
  • For an administrator, it uses %ProgramData%\Microsoft OneDrive\setup\
• Uses "cmd.exe /c move" to relocate the executable and rename it to OneDriveLauncher.exe.
• Creates a scheduled task named OneDrive Launcher to run LuciLoad at user logon.

2. LuciDoor first attempts to reach its C2 server over a direct TCP connection. If that fails, it reads the proxy address from Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer and tries to connect through the proxy using HTTP CONNECT, then SOCKS5, then SOCKS4. If no proxy is configured, or if all proxy attempts fail, it enumerates active TCP connections, looks for hosts using common proxy ports, treats those hosts as potential proxies, and retries the same connection sequence.

3. LuciDoor collects basic system information and sends it to the C2 server as a report. The report includes the following fields:

• Full DNS computer name
• Windows OS name from SOFTWARE\Microsoft\Windows NT\CurrentVersion
• Current username
• System architecture type, where 1 indicates non-x86 and 0 indicates x86
• System language identifier (LCID)
• Client network address and port in <IP> and <PORT> format, separated by a colon
• Campaign timestamp from the configuration
• Sleep calculation parameter from the configuration

4. It then builds an HTTP POST request header in the following format:

POST http://<hostname>/sys/index.jsp HTTP/1.1\r\n
Host: <hostname>\r\n
User-Agent: Mozilla/5.0 (compatible; Windows NT; rv:72.0) Gecko/20100101 Firefox\r\n
Cache-Control: no-cache, no-store, must-revalidate\r\n
Content-Type: application/octet-stream\r\n
Content-Length: <body_length_bytes>\r\n
Accept: */*\r\n
\r\n
<binary_body>

5. LuciDoor encrypts the assembled message byte by byte using XOR. The first three header bytes, a random byte, a command identifier, and the MsgMarker value, are encrypted using chained XOR with feedback, where each byte is XORed with the result of the previous encryption step. It then computes a one-byte checksum of these three encrypted bytes and uses it as the initial key. The remaining message payload is encrypted sequentially, where the first payload byte is XORed with the initial key and each subsequent byte is XORed with the previously encrypted byte, which is consistent with ciphertext feedback behavior.

6. Finally, LuciDoor reads the server response and decrypts it. The received packet uses a fixed structure. That structure is the same for encryption and decryption.

Table 2. Generated message structure

For each command, the client and server keep the same MsgType value throughout the command's execution. They use it to confirm the processing sequence. The MsgMarker field indicates the current stage of execution.

A MsgMarker value of 0 indicates successful processing. A value of 1 indicates an intermediate stage. This is used during staged data transfer when more blocks are expected to be sent or received. A value of 2 indicates an error, and the payload includes the corresponding error code.

One detail matters for message construction. In outbound messages, the client includes the campaign timestamp. In responses, the server returns a specific magic value. The client compares that value against a reference value stored in the configuration.

The backdoor supports multiple functions, including interpreter initialization, remote command execution, file upload, and file exfiltration. Table 3 provides a detailed description.

Table 3. LuciDoor commands

In the November attack, attackers deployed a second backdoor, MarsSnake. Like LuciDoor, MarsSnake supports configuration updates without recompiling the executable and includes a distinctive marker. To change the configuration, the attackers only need to edit an embedded XOR-encrypted block that stores the relevant parameters.

In early 2026, a file associated with the September campaign infrastructure at 5.181.1.153 was uploaded to a public sandbox.

We compared payloads across both campaigns and concluded that the samples used in the November attack are the MarsSnake backdoor.

One indicator was a PDB path present in the 2026 samples that did not appear in any of the November samples:

D:\project\MarsSnake\bin_shellcode\load_http_64.pdb

ESET previously reported a similar path:

D:\yu_project\MarsSnake\bin_shellcode\load_http_64.pdb

As with LuciLoad and LuciDoor, MarsSnake is delivered as a final payload by a dedicated loader, which we named MarsSnakeLoader.

When MarsSnakeLoader runs, it decrypts an embedded blob using RC4 with a hard-coded key, "qio1239djk123sd.a; 13", and then decompresses the result using the DEFLATE algorithm. It allocates executable memory in the process address space and copies the decrypted payload into that region.

Before it transfers execution to the backdoor entry point, MarsSnakeLoader searches the payload for the string "OOkupFunction71N". If the string is present, it writes a prepared configuration to the corresponding address. The configuration consists of repeated "OOkupFunction71" strings plus a C2 configuration that is XOR-encrypted with the same string. The C2 configuration contains connection details and supports up to three entries.

It's noteworthy that the backdoor's initial configuration contains local addresses. This likely reflects an artifact from attacker-side local testing.

This design has an important side effect for analysis. If you extract the payload statically, you may miss the configuration because it is written at runtime. It also makes the tooling modular. To change the C2 server, the attacker only needs to update the loader configuration, which is what we observed in these campaigns.

MarsSnake decrypts its configuration and collects the following information:

• Local IPv4 address
• Windows version
• Username
• NetBIOS computer name

MarsSnake also uses the collected data to compute a unique system identifier. The calculation works as follows:

1. It builds a string in the format <computer_name><local_ip><username>. It then expands the string by duplicating each byte into a pair as such:

• riginal byte
• original byte ⊕ 0×5A

2. The resulting sequence is used to calculate the hash using the formula: hash = hash × 31 + byte.

3. It formats the final value as a GUID-like identifier using %08llx-%04llx-%04llx-%04llx-%012llx, where:

• The first three fields are derived from the computed hash value using its high and low parts.
• The fourth and fifth fields are fixed constants: 0×8E7C and 0×49EEB6C29776DE0F.

Before it sends the collected information to the command-and-control server, the backdoor connects to one of the C2 servers listed in its configuration. It then sends the magic value "dsalsjd89w21dcx9cwad@" in an HTTP POST request. The server response must include the magic value "asdas290e/cz/x213/.14". If the backdoor receives the expected response, it transmits the system information and waits for a command in the response.

Table 4. MarsSnake commands

A key element of the network protocol is the marker "&@&DWJ@&! @(@#&(@$&^". Both the client and the server use it to signal command completion or interruption.

All backdoor messages follow a fixed structure and include the current time as one of the transmitted parameters. The message format is as follows:

POST /eg.js?t=<unix_time> HTTP/1.1\r\n
Accept: */*\r\n
User-Agent: Mozilla/5.0 (Windows NT 10.0; ) AppleWebKit/537.36 (KHTML, Gecko) Chrome/137.0.0.0  Edg/137.0.0.0\r\n
Connection: Keep-Alive\r\n
Content-Type: application/octet-stream\r\n
Content-Length: %d\r\n
\r\n
data=<ENCRYPTED_BODY>

The request body starts with a two-byte length field, followed by the transmitted data. Each value is first obfuscated with XOR using the key "rYB1oDHVMViTRnaGsFw1TbHJ1z1aZ". The resulting buffer is then encrypted as a whole using AES-128 in ECB mode, with no initialization vector, using the same key.

During the investigation, we identified additional MarsSnake samples that used the same naming convention as the Kyrgyzstan artifacts, PDH.DLL.

As in previous cases, these libraries masqueraded as the legitimate Windows Performance Data Helper module.

One of the samples we identified used the IP address 5.181.1.153. This IP address was previously associated with the domain button.gdakdbysw.xyz, which served as the LuciDoor command-and-control server during the September Kyrgyzstan campaign.

We also found MarsSnake samples linked to an attack targeting China. We cover that activity below.

ESET attributed MarsSnake-related activity to a threat group it named UnsolicitedBooker. ESET also reported overlap between this group and Space Pirates, and observed related activity targeting Saudi Arabia.

Interestingly, the document content itself was written in Russian. At the same time, the Declared Languages and Language Guesses fields listed three languages, Arabic (Saudi Arabia), English, and Chinese.

Notably, the documents themselves include eastAsia="zh-CN" in word/settings.xml, even though Chinese does not appear anywhere in the document content.

Given that the document content is entirely in Russian, this suggests one of two possibilities. The author likely used a Chinese-language installation of Microsoft Office, or they used a Chinese document template and did not clear the themeFontLang setting.

The threat actors used images designed to prompt the recipient to enable macros. These images were created with Snipaste, a Chinese screen capture tool. As a result, the documents all contained the distinctive metadata string "Generated by Snipaste".

This metadata marker is relatively uncommon and appears mostly in Chinese-language contexts. For example, only a small number of documents with this string show up in public sandboxes, and the ones we reviewed were all of Chinese origin.

Notably, we saw this metadata only in the 2025 activity. In 2026, the attackers switched to a different image (see Figure 7). That image is not new. It also appeared in a 2023 malicious document attributed to the Vicious Panda group, where the Chinoxy backdoor was used. Even so, we did not observe any other overlaps between UnsolicitedBooker and Vicious Panda.

In at least one case, we observed a TLS stack with a distinctive fingerprint associated with the outdated PolarSSL library. That stood out and warranted a closer look.

PolarSSL was renamed and continued as Mbed TLS in 2015. On MikroTik RouterOS, enabling www-ssl causes the system to generate a certificate that is signed by the built-in test CA from the Mbed TLS library, previously PolarSSL. Under normal conditions, there is little reason to use PolarSSL directly because it is an obsolete project that continues under a new name. Another detail was also unusual. On the investigated C2 server, this TLS stack was running on the standard port 443 rather than a non-standard port.

Further analysis confirmed the root cause. The PolarSSL fingerprint appeared because the attackers had compromised a MikroTik router and were using it as a C2 server.

While searching for additional indicators, we found identical MarsSnake samples uploaded from China. One such sample was PDH.DLL (SHA-256: a3f223350e03fb7ae6ac4ddf170a94d40da0a525375b764d361a033af5ea15e8), contained within an archive (SHA-256: 3c9e76eee8c813e2de16640504118550b18b21e4f951df47ef8914bb5b7a031b).

The archive had the following structure:

The .init directory is hidden. By default, opening the archive shows only a .lnk file. Its filename is in Chinese and refers to water meter pricing in Chongqing.

This approach, a .lnk file paired with multiple hidden subdirectories, has been observed repeatedly in Mustang Panda operations, including in BlackBerry research. That said, the payload in this case is materially different.

The .lnk file launches version.txt, which is actually a BAT script.

The script moves help.log to C:\ProgramData, renames it to help.vbs, and runs it.

The help.vbs script creates C:\ProgramData\Oracle\Java\installcache\. It then moves plasrv.log into that directory, renames it to plasrv.exe, and executes it. As part of cleanup, the script deletes the original LNK file and the hidden directory, then deletes itself.

The plasrv.log/plasrv.exe file is identical to the MarsSnake backdoor we observed in the Kyrgyzstan activity that used the C2 server 81.70.28.71. In this case, the backdoor was delivered directly, without MarsSnakeLoader.

MarsSnake appears to be a relatively uncommon tool. We have not seen references to it outside an ESET quarterly report, so we currently treat it as unique to this threat group. Based on the evidence available, we assess that this activity reflects either a penetration test or that UnsolicitedBooker is a cybercriminal group that also targets China.

During the investigation, we also noted an unusual LNK creation timestamp, "2019:12:07 09:09:51+00:00", and the Machine ID "desktop-s2c6iad". StrikeReady Labs referenced this Machine ID in 2024 in the context of an attack targeting Chinese customs.

We pivoted on the same creation timestamp and Machine ID and identified about 40 additional malicious files. Most were in Chinese, and many were linked to targets in Hong Kong, mainland China, Taiwan, and South Korea.

One example was "ด่วนมาก เชิญเข้าร่วมโครงการความร่วมมือฝึกอบรมหลักสูตร FBI.docx.lnk" (SHA-256: 2f52aa02ccc45e5a4f5a8045aeb42f8428b48a5 814 435ffb8d75d41a7 735 811c). Mustang Panda used this LNK in an attack targeting the Thai police. The Machine ID was different, but the creation timestamp matched. It was "2019:12:07 09:09:51".

Further analysis showed that the timestamp and Machine ID align with LNK files from the FTPlnk_phishing repository on GitHub. This is a Chinese penetration-testing tool, and the repository includes a disclaimer about lawful use.

These findings indicate that at least two threat groups, Mustang Panda and UnsolicitedBooker, used FTPlnk_phishing in their operations.

ESET previously reported UnsolicitedBooker activity targeting Saudi Arabia. As our analysis shows, traces of that focus still appear in the group's phishing documents. By the fall of 2025, however, the group shifted to telecommunications targets in the CIS and continued this activity into 2026.

Across these operations, the group used several rare tools of Chinese origin. Notably, early activity relied on a backdoor we named LuciDoor. Later campaigns switched to MarsSnake. In 2026, the group returned to LuciDoor.

We also observed at least one case where the attackers used a compromised router as a C2 server. We also identified infrastructure elements that, in the context of specific attacks, appeared to be masquerading as Russian.

• PTESC_apt_win_CN_UnsolicitedBooker__Backdoor__LuciDoor
• PTESC_apt_win_CN_UnsolicitedBooker__Dropper__LuciLoad
• PTESC_apt_win_CN_UnsolicitedBooker__Backdoor__MarsSnake
• PTESC_apt_win_CN_UnsolicitedBooker__Dropper__
  MarsSnakeLoader

• Trojan.Win32.Generic.a

• Trojan.LuciDoor
• Trojan.LuciLoad
• BScope.Trojan.LuciLoad
• Trojan.Win64.MarsSnake

• REMOTE [PTsecurity] MarsSnake Checkin sid: 10 016 190
• REMOTE [PTsecurity] LuciDoor C2 Communication sid: 10 016 281